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Abstract 

We propose a formal proof of the undecidability of the model checking problem for alternating 
time temporal logic under imperfect information and perfect recall semantics. This problem 
was announced to be undecidable according to a personal communication on multi-player 
games with imperfect information, but no formal proof was ever published. Our proof is 
based on a direct reduction from the non-halting problem for Turing machines. 
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1. Introduction 

The Alternating-time Temporal Logic (ATL) have been introduced in [l| as a logic to 
reason about strategic abilities of agents in multi-agent systems. ATL extends CTL by 
replacing the path quantifiers V and 3 by cooperation modalities ((^)), where yl is a team 
of agents. A formula ^A))lp expresses that the team A has a collective strategy to enforce 
ip. 

The semantics of ATL is defined over concurrent game structures (CGS) [l| which are 
transition systems whose states are labeled by atomic propositions and for which a set 
of agents is specified. Each agent may have incomplete/imperfect information about the 
state of the system in the sense that the agent may not be able to difference between some 
states. When the agent is able to observe the entire state labeling, we say that he has 
complete/perfect information. A transition from a state to another one is performed by an 
action tuple consisting of an action for each agent in the system. The action an agent is 
allowed to perform at a state is chosen from a given set of actioned allowed to be performed 
by the agent at that state and may depend on the current state (this is called imperfect 
recall) or on the whole history of events that have happened (this is called perfect recall). 
Combining imperfect or perfect information with imperfect or perfect recall we obtain four 
types of concurrent game structures and, consequently, four types of semantics for ATL. 
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A series of papers have been addressed the mo del- checking problem for ATL [H, Is], [if. 
Based on unpublished work of Yannakakis the model checking problem for ATL with 
imperfect information and perfect recall semantics was announced to be undecidable in [ij. 
Since then, many authors have mentioned this result but, unfortunately, no formal proof 
was ever published (see also (2}]). 

In this paper we propose a formal proof of this problem. Our proof is based on a 
direct simulation of Turing machines by concurrent game structures under imperfect in- 
formation and perfect recall, which allows for a reduction of the non-halting problem for 
Turing machines to the model checking problem for ATL under imperfect information and 
perfect recall semantics. Moreover, the strategies used by agents to simulate the Turing 
machine are primitive recursive. This shows that the undecidability of model checking ATL 
under imperfect information and perfect recall semantics is mainly due to the imperfect 
information agents have about the system states. 

While our proof is given for the de dicto strategies from the same construction 
works also for the de re strategies from j^, Isf . 

2. Alternating-time Temporal Logic 

We recall in this section the syntax and semantics of the alternating-time temporal 
logic. We will mainly follow the approach in |2|] and fix first a few notations. N stands 
for the set of positive integers (natural numbers) and V denotes the powerset operator. 
Given a set V, V'^ denotes the free semi-group and V* denotes the free monoid generated 
by V under concatenation. A stands for the empty word (the unity of V*). The notation 
f : X -^Y means that / is a partially defined function from X to Y. 

ATL syntax. The syntax of ATL is given by the grammar 

'f::=p\^^\^A^\{{A))Ov\{{A))n^\{{A))^U^ 

where p ranges over a finite non-empty set of atomic propositions 11, A is a non-empty 
subset of a finite set Ag of agents, and O, □, and U are the standard temporal operators 
next, globally, and until, respectively. 

Note that, in order to define combinations of temporal operators inside the coalition 
operators, the weak-until operator should be given as a primitive operator since it 
cannot be derived from the above operators. However our result holds also for this restricted 
syntax. 

ATL semantics. ATL is interpreted over concurrent game structures (CGS) Such a 
structure consists of a set of states labeled by atomic propositions and a set of agents. Each 
agent may perform some actions and at least one action is available to the agent at each 
state. His decision in choosing which action should be performed at some state may be 
based on his capability of observing all or some atomic propositions at the current state, 
usually called perfect or imperfect information, and on his full or partial history, usually 
called perfect or imperfect recall. 
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In what follows we focus on CGS under imperfect information and perfect recall and 
adopt the formal approach in |2|]. A CGS under imperfect information is a tuple Q = 
(Ag, S, n, TT, (-j \i 6 Ag),Act, d, where: 

• Ag = {1, . . . , /c} is a finite non-empty set of agents; 

• iS is a finite non-empty set of states; 

• n is a finite non-empty set of atomic propositions; 

• TV : S ^ V{Il) is the state-labeling function; 

• ~j is an equivalence relation on S, for any agent i; 

• Act is a finite non-empty set of actions; 

• d : Ag X S ^ V{Act) - {0} gives the set of actions available to agents at each state, 
satisfying d(i,s) = d(i,s') for any agent i and states s and s' with s ~i s'; 

• ^: S X Act'' ^ 5" is the (partially defined) transition function satisfying, for any s e S 
and (ai, . . . ,ak) e Act'', the following property: 

(s, (ai, . . . ,afe)) is defined iff e d(i,s) for any agent i. 

We will write s ^' ' ''^^ s', whenever ^ (s, (ai, . . . , a^)) = s'. 

If s and s' are ~j-e<iuivalent (i.e., s ~j s') then we say that s and s' are indistinguish- 
able from the agent z's point of view (due to his partial view on the states). Each ~j is 
component-wise extended to sequences of states. Thus, for a, a' e 5^ we write a a' and 
say that a and a' are ^i-equivalent if a = SQ---Sn and a' = Sq---s^ for some n e N, and sj ~j s^- 
for all < j <n. 

A perfect recall strategy for an agent z in a CGS ^ is a function a : S^ ^ Act which is 
compatible with d and ~j, i.e., 

• a(as) e s), for any a e S* and s e S'; 

• cr(a) = cr(a;'), for any a, a' € 5"+ with a ~j a'. 

A perfect recall strategy for a team A of agents is a family cta = (cjl? e A) of perfect 
recall strategies for the agents in A. If aA is a perfect recall strategy for the agents in A, 
as e S*S, and a = (ai, . . . ,0^) e Act*^, then we write a e ^^(as) if the following properties 
hold: 

• ttj € s), for any i € A^r - A; 

• Oj € (Tj(Q;s), for any i e A. 
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Given a state s oi G and as above, define outg(s,aA) as being the set of all infinite 
sequences of states A = SoSiS2--- such that sq = s and, for any j > 0, there exists a £ 
^A(so---Sj) with Sj —>■ Sj+i. For A = sqSiS2--- an infinite sequence of states and j > 0, X[j] 
denotes the j-th state in the sequence, X[j] - Sj 

The imperfect information perfect recall semantics for ATL, denoted \=iji, is defined as 
follows is a CGS under imperfect information and s is a state of ^): 

• {Q,s) if p e 7r(s); 

• {G, s) \^iR ^ip if s) if; 

• {G, s) \=iR^p/\ip if {G, s) \=iR (f and {G, s) \=iR ip; 

• (G, s) \=iR {{A]pip if there exists a perfect recall strategy such that (G, A[l]) \=iR (p, 
for any A € outg{s, cr^); 

• (G, s) Njfl {{A])a(p if there exists a perfect recall strategy cr^ such that (G-, A[j]) \=iR </?, 
for any A e outg{s,aA) and any j > 0; 

• {G,s) \^iR {A}LpU'iij if there exists a perfect recall strategy o"^ such that for any 
A e outg{s,aA) there exists j > with (^,A[j]) Njj? ip and (^,A[fc]) i=iR (p for all 
0<k<j. 

The model checking problem for ATL formulas under imperfect information and perfect 
recall semantics is to decide, given an ATL formula ip, a concurrent game structure G under 
imperfect information, and a state s of G, whether {G,s) \=iR (p. 

Computation trees. The proof of our main result in the next section will be based on 
computation trees associated to CGSs. These are special cases of labeled trees, which are 
structures T= {V, E,Vo,lij2), where 

• {V, E,vq) is a tree whose set of nodes is V, whose set of edges is E, and whose root 
is vo; 

• h is the node-labeling function; 

• I2 is the edge-labeling function. 

Paths in a labeled tree T = {V, E,vo,li,l2) are defined inductively as usual as sequences 
of nodes: 

• is a path in T; 

• if Vo---Vn is a path in T and (vn,v) € E, then VQ---VnV is a path in T. 

If V is a node of T, then pa,th']-{vQ,v) stands for the unique path from the root vq to v in 
T. The number of nodes on a path r is the length of r, denoted |r|. The labeling function 
li is homomorphically extended to paths, that is, Ii{tiT2) = Ii{ti)Ii(t2) . 

Levels in a labeled tree T = (V, Vq, /i, ^2) are sets of nodes of T defined inductively as 
follows: 
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• levelriO) = {vq}; 

• levelf(n + 1) = {v e V\(3v' e level-j-{n)){{v' , v) e E)}, for any n > 0. 

level'j-(n) is referred to as the level n in T . 

Given a CGS ^, a state s of ^, a coalition A of agents, and a perfect recall strategy a a 
for agents in ^4, define inductively the s-rooted computation trees of Q under a a as follows: 

• any tree with exactly one node (its root) labeled by s is an s-rooted computation 
tree of Q under a a, 

• if T = (V^, E, VoJijh) is an s-rooted computation tree of Q under cr^, f is a node of T, 
and h(v) s' for some action-tuple a e a A{li{pcbth'Y{yo,v))) and state s' such that 
no edge from v is labeled by a, then the tree T' obtained as follows is an s-rooted 
computation tree of Q: 

— T' is obtained from T by adding a new node v' labeled by s' and an edge ') 
labeled by a. 

If T' is obtained from T as above, we will also write T^g^ajJ'' or T ^Q,aA if want 
to specify the action tuple a as well. 

Remark 1. It is easy to see that, for any atomic proposition p, the following property 
holds true: 

• {Q,s) \=iR ([A^np if and only if there exists a perfect recall strategy a a such that 
p e 7r(/i(f)), for any s-rooted computation tree T of Q under a a, o,nd any node v of 

r. 

3. Undecidability of Model Checking ATLm 

We will prove in this section that the model checking problem for ATLm is undecidable. 
The proof technique is by reduction from the non-halting problem for deterministic Turing 
machines. Given a deterministic Turing machine M, we construct a concurrent game 
structure under imperfect information Q with three agents Ag = {1,2,3}, a state Sinu of Q, 
and an ATL formula (({l,2}))n ok, where ok is an atomic proposition, such that M does 
not halt on the empty word if and only if {Q,Sinit) ^ir (({l,2}))n ok. 

The deterministic Turing machines we consider are tuples M - {Q,T,,qo,B,d), where 
Q is a finite set of states, E is a finite tape alphabet, qo is the initial state, S e E is the 
blank symbol, and ^iQxE^QxEx {L,R} is a partially defined transition function, 
where "L" specifies a "left move" and "i?" specifies a "right move". A configuration of 
M is a word ai---aj_igaj---a„, where all a's are from S and g is a state. Such a configura- 
tion specifies that M is in state q, its read/write head points to the ith cell of the tape, 
and the jth cell holds aj if j < n, and B, otherwise. The initial configuration is qoB. 
The transition relation on configurations, denoted =^m, is defined as usual. For instance, 
ar-ai-iqai--an^Mav-q'ai-ia'----an if i > 1 and S{q,ai) = {q',a'-,L). 
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The Turing machine M halts on the empty word if, starting with the initial configura- 
tion, the machine reaches a configuration ai---ai-iqai---an for which d(q,ai) is undefined or 
i = l and 6(q,ai) = (q',a'^,L) for some q' and a'^. 

Intuition first. The main idea of the construction is to encode the configurations of the Tur- 
ing machine horizontally in the levels of the computation tree. A configuration ay-ai-iqaf-ak 
of M will be simulated in A by some level in some computation tree like in Figure [1] (where 
i - 2 and k = 3). The nodes of this tree are represented by circles. The label of a node 




Figure 1: Level corresponding to aiqa2a3 



is carried inside the circle representing the node. The node labeled specifies the left 
border of M's tape, the node labeled is a cell separator also used to transfer information 
between paths of computation trees, the nodes labeled s^^ and specify the content of 
the first and third cell, respectively, and the node labeled Sq^a2 specifies both the content 
of the second cell and the fact that M is in state q and its read/write head points to the 
second cell. 

The generation of the initial configuration qoB of M is simulated by the computation 
tree in Figure |2l All states in this tree ale labeled by ok; the node labeled Sgen has one 
more label, namely pi (this label is graphically represented because it will be particularly 
important in defining the agents strategies). As we will see later, the two maximal paths 
in this tree are ~2-equivalent. This allows, together with the strategy we will use, for the 
synchronization in the last computation step of these paths. 




Figure 2: Generating the initial configuration qoB of M 
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The levels encoding configurations of the Turing machine will be encoded on the even 
positions in a computation tree, the odd levels being used for correctly representing transi- 
tions of the Turing machine. Some nodes in the levels of even index will then encode tape 
cells, while some other nodes will be used for transferring information between adjacent 
cells. Some examples presenting this idea are given in the following, before the formal 
construction and proof. 

A computation step 01^0203 =>m aia'^q'a^, in the Turing machine is simulated by ex- 
tending the computation tree in Figure [1] as in Figure |3l The synchronization between the 
fourth and fifth paths is possible because, as we will see, these paths are ~i-equivalent. 
Similarly, the synchronization between the fifth and sixth paths is possible because these 
paths are ~2-equivalent. 




(4)"" (^)'' (^T) ^(4^ ~~^~(^ 

-I- ,1- _~ ,L 

\ I (i, (g, g', i) [ !_ ^ 

Figure 3: Simulation of 01(70203 =>m aiai^q'a^ 



The simulation represented in these two figures proceeds as follows: in the observable 
history corresponding to the path ending in Sg^^j, the only possibility for agent 1 to put 
the system in a state which satisfies ok at the next level is to take action {q,q',R), which 
corresponds to the transition S(q,a2) = {q'.a^.R) in the Turing machine. Due to identic 
observability for agent 1, the same action has to be played by agent 1 in the history which 
ends in state which is next to the right of state 55,02- The effect of this action in state 

(combined with an idle action for agent 2) is to bring the system in state Sq^q'^R. In 
this state, it's upto agent 2 to try to satisfy ok at the next step, and he can only do this 
by applying the action (q,q',R). The effect of this action in state Sq^q'^R is to bring the 
system back in state s[,^. But the same action has to be played by agent 2 in the history 
which ends in state s^g on level 3 of the tree, due to identical observability. This play will 
lead the system to state Sg',a3- 

On the other hand, in state s^^, in order to ensure ok, both agents must play idle, which 
leaves the system in state Sa^- Identical observability will then ensure that agent 1 has to 
play idle also in state which is next to the right of state Sa^, and agent 2 has to play 
idle in state s',, on 3rd and 4th levels. 
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The effect of all these is that level 4 on this tree encodes the configuration aiq'a^a^-, 
which results from applying the transition 5{q, 02) = (g', ttg, R) to the configuration 01^0203. 

States Sg^Yi and 

Str are used for "creating" all the nodes that simulate tape cells. In a 
computation tree which satisfies the goal uok, these are the only states to have two sons. 

Figure m presents the simulation of the computation step 01^0203 q'aia^a^i Note 
here that the role of agents 1 and 2 are interchanged because it is a left transition. 
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Figure 4: Simulation of aiqa2a^ =^m (/'aiajOa 

And in Figure [5l a simulation of the computation qoB =>m agii? 5206 is shown. 

Construction of a game structure associated to M. The concurrent game structure under 
imperfect information Q = (Ag, S,Il,7r, Act,{^i \i € Ag),d,^) that simulates the determin- 
istic Turing machine M is based on three agents, i.e. Ag = {1,2,3}. Its set S of states, 
together with their meaning, consists of: 

• Sinit (the initial state); 

• ^'init (copy of Sinit)] 

• Sib (specifies the left border of M's tape); 

• s'lf^ (copy of sib); 

• Sgen (initiates the generation of a new blank cell of M's tape); 

• Str (initiates the generation of a new cell separator); 

• s[^ (used for transferring information between to equivalent runs); 

• Sai for any a € S (specifies that some tape cell holds a); 

• Sq^ai for any state q^ Q and a e S (specifies that M is in state q and the read/write 
head points a cell holding symbol a); 
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{i,iqo,qi,R),i) 
{i,{qi,q2,L),i) 



Figure 5: Simulation of the computation qoB =>m aq\B =>m 92^6. 



• Sq^q'^x, for any q,q' e Q and X e {L,R} such that S{q,a) = (q',a',X) for some a and 
a' (specifies that the machine M enters state q' from state q by an X-move); 

• Serr ("error" state used to collect all "unwanted" transitions the agents must avoid 
bringing the system in this state). 

The set of atomic propositions is 11 = {^1,^2,0^;} and the labeling function tt is: 



7r(s) 



{ok}, if S € 5* {Sgem ^tri ^err\ 

{pi,ok), lis = Sgen 

{P2,0k}, lis = Str 

0, if S = Sprr 



For the sake of simplicity, all states but Sgrr will be called ok-states (being labeled by ok). 
The relation ~3 is the identity. The equivalence relations ~i and ~2 are defined by 

s ~i s' iff (pi6 7r(s) <^ pi&nis')), 
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for any i = 1,2. That is, s and s' are ~i-equivalent if the agent i observes pi either in both 
states s and s' or in none of them. 
The set Act of actions consists of: 

• idle, which is meant to say that the agent doing it is not "in charge of" accomphshing 
some local objective (this action will be abbreviated by i in our pictures and whenever 
no confusion may arise); 

• (90)) which is an action meant to set up the initial state of M; 

• {q, q', X), for any q,q' and X e {L, R} with 6{q, a) = {q' , a', X) for some a, a' e E. 
Such an action simulates the passing of M from q to q' by an X-move; 

• bri and br2, which are two "branching" actions. 

The agents 1 and 2 are allowed to perform any action but bri and br2, while the third 
agent can only perform bvi, br2, and idle. More precisely, d(i,s) = Act - {bri,br2} for any 
i e {1,2} and state s, d{3,s) - {bri,br2} if s e {simt; ■Sgem Str}; and d{3,s) = idle, otherwise. 

Note that the agents' actions are designed such that d(i, s) = d(i, s') for any agent i 
and states s and s' with s s'. 

The transition relation of the game structure is as follows: 



(i,i,bri) (i,i,br2) 

' Sinit and - 

above action tuples; 



• Sinit — — > s'-^it a^'i ^init — — ^ Sgen and Sinit ^ Serr, for any c different from the 



• s'i^it and s'^^^^ ^ Serr, for any c / {i,i,iy, 

• sib s[f^ and sib Serr, for any c ^ (i, (qo),iy, 

• ^ib "^^^ ^'ib and S/'b Serr, for any c ^ (i, i, i); 

• Sgen ^ ' ' and Sgen ^ ' ' ^^'> Sfr and Spen Serr, for any c different from the above 
action tuples; 

• ^ ' ' ^"'> and Str ^ ' ' ^"'> S(,en and Str — ^ Serr, for any c different from the above 
action tuples; 

• for any a e E, the transitions at Sa are: 

(i,(?o),i) 
~ Sb >■ Sqo,B; 

{i,{q,q',R),i) r , t->\ 

- Sa > Sg,a, for any action {q,q',R); 

- Sa > Sq^a, for any action {q,q',L); 
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— Sa Serri for any c different from any of tlie above actions; 

• for any q^Q and a € S, the transitions at s^^a are: 

{(q,q',R),i,i) / , , D\ 

- Sg^a ^ Sa', if d{q,a) = {q',a',R); 

{{q,q',L),i,i) 

- Sq^a ^ Sa', if o{q,a) = {q',a',L); 

~ Sq,a ~^ Serr, for any c different from any of tlie above actions; 

• tlie transitions at sj,^ are: 

- ((g-g 'R)'''')^ Sg^g'^R, for any action (q,q',Ry, 

- '^)'')^ Sg^g'^L, for any action {q,q',L); 

— s'f.j. Serr, for any c different from any of tlie above actions; 

{i,(q,q',R),i) {(q,q',L),i,i) , , „ ^ j 

• Sg^g'^R > s[.^ and Sg^g'^L ^ Sj.^ and Sg^g^^x Serr, tor any A and any c 

different from any of the above actions. 

Proof of the correctness of the construction. Let M be a deterministic Turing machine. 
Without loss of generality we may assume that M, starting in state qo, will never reach 
again go- 

First, we prove that if M does not halt on the empty word then (Q, Sinu) ^iR (({1, 2}))n 
ok. According to Remark [T], it suffices to show that, if M does not halt on the empty 
word, then there exists a strategy a = (ai,o"2) for the agents 1 and 2 in ^ such that any 
■Smit-rooted computation tree of G under a has only nodes labeled by ofc-states. 

In order to define a with the property above, we classify the non-empty sequences of 
states of Q as follows: 

• a sequence a e 5*+ is of type i if a = Sinitsl^^^^a' , where a' e 5"*; 

• a sequence a € 5+ is of type 2 if a = SmuSgenCt' , where a' e S*. Type 2 sequences of 
states can be further classified according to the number of states Sgen and Str they 
contain: 

— a sequence a is of type 2(i)(i-l), where i > 1, if a = Sinit{s genStrY'^ s genO(' , where 
a' € S* does not contain Sgen and Str', 

— a sequence a is of type 2(i)(i), where i > 1, if a = SinuisgenStrYa' , where a' e S* 
does not contain Sgen and Str- 

Of course, there are sequences a e which are neither of type 1 nor of type 2. A path r 
of a computation tree of Q will be called of type x if Ii(t) is of type x, where x is as above. 
The following claim follows easily from definitions. 
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Claim 1. Let a and a' be two non-empty sequences of states. Then, the following proper- 
ties hold: 

1. If a is of type 1 and a' is of type 2, then a /i a' ; 

2. If a is of type 1 and a' is of type 2 and a ~2 ol' , then a' is of type 2(1)(0); 

3. // a and a' are of type 2, have a different number of Sgen or Str states, and a ~i a' , 
then a is of type 2(i)(i - 1) and a' is of type 2(i){i), or vice-versa; 

4. // a and a' are of type 2, have a different number of Sg^n or Str states, and a ~2 , 
then a is of type 2{i){i) and a' is of type 2{i + l){i), or vice-versa. 

Now, define a strategy a = ((Ti,(72) as follows: 

• Ci(simt) - = idle, for any type 1 sequence a € 5*"^; 

• cr2{sinit) = o'2{a) = idle, for any type 1 sequence a e S'^ different from Sinus'-^-^sn,, and 

• (Ji{aSq^a) = iQ,Q',R) = <^i{c('Str), ^OY any aSga of type 2{i)(i - 1) and any o.'s'f.^ of 
type 2{i){i) for which i>l and the following property holds: 

— laSq^al = 3 + (2j - 1) = for some j > 1, and the agent 1 simulating the first 
J steps of M deduces that the current configuration of M is of the form uqav, 
where = z - 1, and 6(q,a) - (q',a',R), for some q' and a'; 

• ai{asa) = {q,q',L) = ai{a'Sg^g'^L), for any aSa of type 2(i)(i - 1) and any a'Sg,?',^ ^f 
type 2{i){i) for which i>l and the following property holds: 

— \asa\ - 3 + 2j - la'Sq^q'^il for some j > 1, and the agent 1 simulating the first j 
steps of M deduces that the current configuration of M is of the form uaqbv, 
where |m| = i - 1, and S{q,b) - {q',b',L), for some q' and b'; 

• o-2(Q;Sg^g',i?) = {q,q',R) = a2{a'Sa), for any aSg,^',^ of type 2(i)(i) and any a'Sa of 
type 2{i + for which i>l and the following property holds: 

— |Q;Sq,q',ij| = 3 + 2j = \a'Sa\ for some j > 1, and the agent 2 simulating the first j 
steps of M deduces that the current configuration of M is of the form uqav, 
where |m| = i - 1, and S{q,a) = {q',a',R), for some q' and a'; 

• a2ias[^) = (q,q',L) = a2ia'Sg^a), for any as[^ of type 2(i){i) and any a'Sg^a of type 
2(i + l)(i) for which i>l and the following property holds: 

— \as[r\ - 3 + (2j - 1) = |tt''Sg,a| for some j > 1, and the agent 2 simulating the first 
j steps of M deduces that the current configuration of M is of the form uaqbv, 
where |m| = i - 1, and S{q,b) = {q',b',L), for some q' and b'; 

) - (?o); 
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• (Ji{a) = idle and (72 (a') = idle for all the other cases. 

The strategies ui and a2 are both compatible with d, ai is compatible with ~i, and (T2 
is compatible with ~2- 

Any tree with exactly one node (its root) labeled by Smit is an Sj„jrrooted computation 
tree of Q under a and its nodes are all labeled by o/c-states. 

Assume that T is an Sj„jj-rooted computation tree of G under a and all its nodes are 
labeled by o/c-states. It is easy to see that T may only have type 1, type 2(z)(i - 1), or 
type 2{i){i) paths, for some i>l. Any extension T' of T (i.e., T^g^aT') adds new nodes 
to T which cannot be labeled by Sgrr because M does not halt (see the definition of cr). 
Therefore, any Sj„jt-rooted computation tree of G under a has all its nodes labeled by 
o/c-states. 

Conversely, we show that M does not halt on the empty word if all Si„jt-rooted com- 
putation trees of Q under some strategy a for {1,2} have only nodes labeled by ofc-states. 

Let a he a strategy with the property above and consider an Sj„irrooted computation 
tree T - (y,E, vojijh) under a. A node f of T will be called of type x if li(pathr{vo,v)) 
is of type x {x is 1, 2, 2(i)(i - 1), or 2(z)(i), for some i > 1). 

We then define a partial ordering <j- on the nodes of T as the least partial ordering 
with the following properties: 

• if f and v' are nodes on the same level of T and li(v') e {sgen, Str}, then v <r v'; 

• if f and v' are nodes on the same level of T and there exist u on the path from root 
to V and u' on the path from root to v' with u <j- u', then v <j- v' 

Some properties of T and its level sets are listed in the sequel. 

Claim 2. Let T = {V,E,vo,li,l2) be an Sinu-rooted computation tree of Q under a, and 
n>l. Then: 

1. levelr{n) has at most n+1 nodes, and each of them is either of type 1, or of type 2, 
or of type 2{i){i - 1), or of type 2{i){i), for some i > 1; 

2. level-Y^n) contains at most one node of type 1; 

3. level^in) contains at most one node of type 2(i)(z - 1) and at most one node of type 
2{i)(i), for each i < \n/2'\; 

4. for any v,v' e levelriji), v <r v' if and only if one of the following properties hold: 

(a) V = v' ; 

(b) V is of type 1; 

(c) V is of type 2(i)(i'), v' is of type 2(j)(j'), and i < j or, if i = j then i' < j' . 

5. <j- is a total ordering on levelj-{n). 

Proof. All the properties in Claim H] can be proved by induction on n > 1 and make use 
of the fact that all nodes of T are labeled by o/c-states. Thus, if f is a node on the level 
n oi T and it is not label by Sgen or str, then it may have at most one descendant v' on 
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the level n + 1 (by a, each of the agents 1 and 2 has exactly one choice at h{v), and by 
d^, the agent 3 has exactly one choice as well at h{v)). Moreover, v' and v have the same 
type. If V is labeled by Sgen, then its type is 2(i)(i - 1) for some i >1, and it may have at 
most two descendants v' and v" on the level n+1 (by a, each of the agents 1 and 2 has 
exactly one choice at /i(f), but the agent 3 has two choices). One of this descendants is 
of type - 1), while the other is of type 2(i)(i) and it is labeled by Str- Similarly, if 

V is labeled by Sfj., then its type is 2{i)(i) for some i > 1, and it may have at most two 
descendants v' and v" on the level n + 1. One of this descendants is of type 2(i)(z), while 
the other is of type 2{i + l){i) and it is labeled by Sgen- 

Combining these remarks with the fact that levelr{l) may contain at most two nodes, 
one of them labeled by s-^^^ (which is of type 1) and the other by Sgem we obtain (1), (2), 
and (3) in the Claim. 

(4) follows from the definition of <j- and the above properties, and (5) follows from (4). 

□ 

If levelr{n) = {vi, . . . ,Vn+i} of an Si„j(-rooted computation tree T oi Q under a has 

exactly n + 1 nodes, then we say that it is complete. Moreover, if we assume that Vi <-]- 
— f^n+i, then we may view levelf{n) as a sequence of nodes, vi---Vn+i- 

Claim 3. Let T = (V,E,vo,li,l2) be an Sinu-rooted computation tree of Q under a, and 
n >1 such that levelr{n) is complete and its sequence of nodes is vr--Vn+i- Then, the 
following properties hold: 

1. levelf{m) is complete, for any m < n; 

2. vi is of type 1, V2i is of type 2{i){i - 1), and V2i+i is of type 2{i){i), for all i>l with 

2i < n; 

3. (a) h{pathrivo,vi)) ^2 h{pathr{vo,V2)); 

(b) h{pa'thr{vo,V2i)) ~i li{pathr{vo,V2i+i)), for all i>l with 2i < n; 

(c) li(pathr(vo,V2i+i)) ~2 h(pathr{vo,V2(i+i))), for alli>l with 2i + l< n; 

4. hivyVn+i) is of the one of the following forms: 

(^) ^^init^gen, if ^ = 1; 

(b) sibSBStr, ifn = 2; 

(*^) ■^lb^aiS'tr'"-Saj.iS'i-^Sq^ajStr'Saj+i---s'f.^Sa„s'i.^Sgen, if U > 2 is odd, wkcrC fll , . . . , OiYn t Zj, 

q ^ Q, m - {n- l)/2, and 1 < j <m (for j = 1, becomes Sg^ai, CLnd for j = m, 
becomes Sq^am); 

(d) 

E, q,q' ^ Q, X e {L, R}, m = n/2, and 1 < j <m - 1; 

5. there exists an Sinu-rooted com,putation tree T' of Q under a such that T =^g,(T T' and 
levelj-'in + 1) is complete. Moreover, if the sequence of nodes of levelj-(n) has the 
form (4a) ((4b), (4^), (4d)), then level j-'{n + 1) has the form (4b) ((4c), (4d), (4^), 
respectively) . 
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Proof. (1), (2), and (3) can be proved in a similar way to the statements in Claim [2l 

We prove (4) and (5) together. It is easy to show that hivyVn+i) has the form (4a) 
if n = 1. As li(pathj-{vo,vi)) ~2 hipath-r (vo,V2)) and T has only oA;-states, the strategy 
(72 should select only idle as the only choice for agent 2 at h(vi) and h(v2). ox should 
select idle for agent 1 at /i(fi) and /i(t'2), while the agent 3 has the only choice idle at 
l\iy\) and two choices, hr^ and f)r2, at l\{y2). Therefore, we can extend T by adding a new 
descendant f[ of V\ and two new descendants v'^ and v'^ of f2, by the rules 

h{Vl) ^h{Vl) = Slb, ll{V2) >li{V2) = SB, ll{V2) > hiv^) = Str- 

We obtain a new Sj„irrooted computation tree T' of Q under a whose level 2 satisfies (4) 
and (5). 

Assume n = 2 and li(vi,V2,V3) = sibSsStr- As li(path-j- (vo,vi)) ~2 hipathr {vo,V2)) and 
T has only o/c-states, the strategy a2 should select only (qq) as the only choice for agent 
2 at and li(v2). The agents 1 has the only choice idle at and l2(v2) (by a"i), 

and the agent 3 has the same choice at these states (by d^). Therefore, we can add a new 
descendant v[ of vi and a new descendant ^ of '^2 by the rules 

ii(t'i) = s«6 ^'i(^i) = 'Si6 and 1\KV2) = sb ^ '1(^2) = ■^.jo.b- 

There are two choices at /i(f3), namely {i,i,bri) and (i,i,br2), allowing to add two de- 
scendants v'^ and of V3 on the next level. Moreover, h{v'^) = s'-f.^ and h(v") = Sgen- As 
a conclusion, T can be extended to a new tree T' whose sequence of nodes on level 3 are 
v'iv'2v'^v'^ and li^v'^v'^v'^v'^) = slf^Sg^^Bs'tr^gen which is the form (4c). Moreover, (5) holds too. 

Assume n > 2 odd, hivyVn+i) of the form (4c), and j > 1 (the case j = I can be 
discussed in a similar way). We have that li(v2j) = Sg^a^ and li{v2j-i) = li{v2j+i) = s[j.. 
Due to the fact that li{path-Y{vQ,V2j)) ~i /i(pa^/ir('^0) "^2^+1)) and T has only o/c-states, 
(Ji should select an action of the form {q,q',R) or {q,q',L) for agent 1 as a choice at 
li(v2j) and li{v2j+i) {q' e Q and this choice is obtained from the transition function of M). 
Assume that this choice is (q,q',R) and S{q,aj) = {q',a'j,R) (the other case is similar to 
this). Each of the agents 2 and 3 has exactly one choice at li{v2j) and li{v2j+i), namely 
idle. Therefore, T can be extended by adding two new descendants and 'i'2j+i by the 
rules 

, . . {(q,q',R),i,i) , , . A 1 f \ I (('l,q',R),i,i) , . , . 

Ii{v2j) = Sq,a, ^ h{v2j) = Sa'^ and li{v2j+i) = s^^. > hyv^j+i) = Sg^g'^n- 

For the nodes Vi with i ^ {2j, 2j + l,n + l}, there is exactly one choice for each agent, namely 
idle, and therefore, a new descendant v'- of Vi can be added by the rule 

ll{Vi) -^^^ li{v'i) = ll{Vi). 

For the node Vn+i we may reason as in the case n = 2 above. Two descendants v'^_^_^ and 
v"^^ can be added, with = sb and ll{v"_^_-^) = Str- 

In this way, we obtain a new tree T' whose level n + 1 satisfies (4) and (5). 

The case "n > 2 even and liiyyVn+i) of the form (4d)" can be treated analogously to 
the above one. □ 
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Consider further the homomorphism h : S ^ (Q u J])* given by: 



if s = s. 



a 



•a 



h(s) = < qa, 
A, 



otherwise 



if s = 



q,a 



We shall write h(levelrin)) for /i(t>i---t>„+i), where vyVn+i is the sequence of nodes 
associated to complete level levelq-in) of some s^jt-rooted computation tree T of ^ under 
cr. 

Claim 4. Let T = (V,E,vo,lij2) be an Sinit-rooted computation tree of Q under a, and 
n>3 odd such that level-j-{n) is complete. Then: 

1. h(levelr(n)) e S*QSS*; 

2. there exists an Sinu-rooted computation tree T' of Q under a such that T =>g,o- T' , 
level'Y'in + 2) is complete, and h{level-j-{n))^njh{level'Y'{n + 2)). 

Proof. From the definition of h, Claim |3l and by inspecting the proof of Claim |3l □ 

It is straightforward to see that there exists an Sj„irrooted computation tree T of Q 
under a whose levelriji) is complete. Moreover, by Claim [3l we have h{levelr{'i)) = QoB 
(that is, the initial configuration of M). Then, combining with Claim |U we obtain that 
M does not halt on the empty word if all s^irrooted computation trees of Q under some 
strategy a for {1,2} have only nodes labeled by o/c-states. 

Our discussion above leads to: 

Theorem 1. The model checking problem for AT Lm is undecidable. 

4. Conclusions 

The proof above shows that the strategies used by the agents 1 and 2 to simulate the 
deterministic Turing machine M are primitive recursive. Therefore, the crucial elements 
which allow to simulate M are the equivalence relations --i and ~2- These equivalence 
relations are "inter-related" and are used to transfer information from one computation 
path can be transferred to another computation path. 

A deeper analysis of the nature of the observational equivalence relations associated to 
agents in a CGS would be interesting. 
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